From d7cec1d3bdc2e62e9ea2ebc034e8ae200d8a7ebd Mon Sep 17 00:00:00 2001 From: Gayathri Vijayan <66356931+grvijayan@users.noreply.github.com> Date: Wed, 21 Jan 2026 13:06:27 +0530 Subject: [PATCH] chore: replace "manager role" with "administrator role" (#11395) # Which Problems Are Solved As part of the naming consistency initiative, the term `Manager Roles` is replaced by `Administrator Roles` # How the Problems Are Solved By replacing `Manager Roles` with `Administrator Roles` in API docs, Console UI, and guides. # Additional Changes N/A # Additional Context - Closes https://github.com/zitadel/zitadel/issues/11293 --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- API_DESIGN.md | 2 +- console/src/assets/i18n/bg.json | 2 +- console/src/assets/i18n/cs.json | 2 +- console/src/assets/i18n/de.json | 2 +- console/src/assets/i18n/en.json | 2 +- console/src/assets/i18n/es.json | 2 +- console/src/assets/i18n/fr.json | 2 +- console/src/assets/i18n/hu.json | 2 +- console/src/assets/i18n/id.json | 2 +- console/src/assets/i18n/it.json | 2 +- console/src/assets/i18n/mk.json | 2 +- console/src/assets/i18n/pl.json | 2 +- console/src/assets/i18n/pt.json | 2 +- console/src/assets/i18n/ro.json | 2 +- console/src/assets/i18n/ru.json | 2 +- console/src/assets/i18n/sv.json | 2 +- console/src/assets/i18n/uk.json | 2 +- console/src/assets/i18n/zh.json | 2 +- docs/docs/concepts/features/selfservice.md | 46 +++++++++---------- .../structure/_manager_description.mdx | 8 ++-- docs/docs/concepts/structure/applications.md | 2 +- docs/docs/concepts/structure/managers.mdx | 4 +- docs/docs/concepts/structure/users.md | 2 +- docs/docs/examples/login/nextjs-b2b.md | 6 +-- docs/docs/examples/login/symfony.md | 12 ++--- docs/docs/examples/secure-api/go.md | 2 +- docs/docs/examples/secure-api/java-spring.md | 2 +- docs/docs/guides/integrate/onboarding/b2b.mdx | 6 +-- .../guides/integrate/retrieve-user-roles.md | 12 ++--- .../zitadel-apis/access-zitadel-apis.md | 10 ++-- .../integrate/zitadel-apis/event-api.md | 2 +- .../manage/console/applications-overview.mdx | 2 +- .../manage/console/console-overview.mdx | 4 +- .../guides/manage/console/users-overview.mdx | 4 +- docs/docs/guides/solution-scenarios/b2b.mdx | 4 +- .../solution-scenarios/restrict-console.mdx | 16 +++---- docs/docs/sdk-examples/go.mdx | 2 +- docs/docs/sdk-examples/java.mdx | 16 +++---- proto/zitadel/auth.proto | 4 +- 39 files changed, 101 insertions(+), 101 deletions(-) diff --git a/API_DESIGN.md b/API_DESIGN.md index 90bb3ef4f..40020932c 100644 --- a/API_DESIGN.md +++ b/API_DESIGN.md @@ -206,7 +206,7 @@ In this case, the settings could share the same `SettingsContext` message to det But do not create a global `Context` message that is used across the whole API if there are different scenarios and different fields required for the context. The same applies to messages that are returned by multiple resources. For example, information about the `User` might be different when managing the user resource itself than when it's returned -as part of an authorization or a manager role, where only limited information is needed. +as part of an authorization or an administrator role, where only limited information is needed. On the other hand, types that always follow the same pattern and are used in multiple resources, such as `IDFilter`, `TimestampFilter` or `InIDsFilter` SHOULD be globalized and reused. diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json index e09fd1653..f7455e14f 100644 --- a/console/src/assets/i18n/bg.json +++ b/console/src/assets/i18n/bg.json @@ -1159,7 +1159,7 @@ "SECRETREMOVED": "Тайната е премахната успешно!" }, "MEMBERSHIPS": { - "TITLE": "Мениджърски роли на ZITADEL", + "TITLE": "Ролите на администраторите в ZITADEL", "DESCRIPTION": "Това са всички безвъзмездни средства за членове на потребителя. ", "ORGCONTEXT": "Виждате всички организации и проекти, които са свързани с текущо избраната организация.", "USERCONTEXT": "Виждате всички организации и проекти, към които сте оторизирани. ", diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json index 7e3436a03..6eddadd9b 100644 --- a/console/src/assets/i18n/cs.json +++ b/console/src/assets/i18n/cs.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Tajemství úspěšně odstraněno!" }, "MEMBERSHIPS": { - "TITLE": "Manažerské role v ZITADEL", + "TITLE": "Role správce ZITADEL", "DESCRIPTION": "Zde jsou všechna členská oprávnění uživatele. Můžete je upravovat také na stránkách detailů organizace, projektu nebo IAM.", "ORGCONTEXT": "Vidíte všechny organizace a projekty, které souvisí s aktuálně vybranou organizací.", "USERCONTEXT": "Vidíte všechny organizace a projekty, na které máte oprávnění. Včetně jiných organizací.", diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json index ebde4d4b7..be91ecde3 100644 --- a/console/src/assets/i18n/de.json +++ b/console/src/assets/i18n/de.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Secret erfolgreich gelöscht!" }, "MEMBERSHIPS": { - "TITLE": "ZITADEL Manager-Rollen", + "TITLE": "ZITADEL-Administratorrollen", "DESCRIPTION": "Dies sind alle Mitgliedschaften des Benutzers. Du kannst die entsprechenden Rechte auch auf der Organisations-, Projekt-, oder IAM-Detailseite aufrufen und modifizieren.", "ORGCONTEXT": "Sie sehen alle Organisationen und Projekte, die mit der aktuell gewählten Organisation in Verbindung stehen.", "USERCONTEXT": "Sie sehen alle Organisationen und Projekte auf denen Sie berechtigt sind inklusive aller zur Auswahl stehenden Organisationen.", diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index 15db8f895..7cacb3c08 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -1161,7 +1161,7 @@ "SECRETREMOVED": "Secret removed successfully!" }, "MEMBERSHIPS": { - "TITLE": "ZITADEL Manager Roles", + "TITLE": "ZITADEL Administrator Roles", "DESCRIPTION": "These are all member grants of the user. You can modify them also on organization, project, or IAM detail pages.", "ORGCONTEXT": "You see all organizations and projects that are related to the currently selected organization.", "USERCONTEXT": "You see all organizations and projects to which you are authorized. Including other organizations.", diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json index 24317318c..6b24a42bb 100644 --- a/console/src/assets/i18n/es.json +++ b/console/src/assets/i18n/es.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "¡Secreto eliminado con éxito!" }, "MEMBERSHIPS": { - "TITLE": "Roles de Mánager ZITADEL", + "TITLE": "Roles del administrador de ZITADEL", "DESCRIPTION": "Estas son todas las concesiones de membresía del usuario. Puedes modificarlas también en las páginas de organización, proyecto o detalles IAM.", "ORGCONTEXT": "Puedes ver todas las organizaciones y proyectos que están relacionados con la organización seleccionada actualmente.", "USERCONTEXT": "Puedes ver todas las organizaciones y proyectos para los que estás autorizado. Incluyendo otras organizaciones.", diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index 9573268fb..83be7144a 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Secret supprimé avec succès !" }, "MEMBERSHIPS": { - "TITLE": "Rôles du responsable ZITADEL", + "TITLE": "Rôles d'administrateur ZITADEL", "DESCRIPTION": "Il s'agit de toutes les attributions des membres de l'utilisateur. Vous pouvez également les modifier sur les pages de détails de l'organisation, du projet ou de l'IAM.", "ORGCONTEXT": "Vous voyez toutes les organisations et tous les projets qui sont liés à l'organisation actuellement sélectionnée.", "USERCONTEXT": "Vous voyez toutes les organisations et tous les projets auxquels vous êtes autorisé. Y compris les autres organisations.", diff --git a/console/src/assets/i18n/hu.json b/console/src/assets/i18n/hu.json index 46418ee0c..cffa98045 100644 --- a/console/src/assets/i18n/hu.json +++ b/console/src/assets/i18n/hu.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "A titok sikeresen eltávolítva!" }, "MEMBERSHIPS": { - "TITLE": "ZITADEL kezelői szerepkörök", + "TITLE": "ZITADEL rendszergazdai szerepkörök", "DESCRIPTION": "Ezek a felhasználó összes tagsági jogosultságai. Ezeket módosíthatod szervezet, projekt vagy IAM részletező oldalakon is.", "ORGCONTEXT": "Láthatod az összes szervezetet és projektet, amelyek a jelenleg kiválasztott szervezethez kapcsolódnak.", "USERCONTEXT": "Láthatod az összes szervezetet és projektet, amelyekhez jogosultságod van, beleértve más szervezeteket is.", diff --git a/console/src/assets/i18n/id.json b/console/src/assets/i18n/id.json index 9d7adc547..4748e55a4 100644 --- a/console/src/assets/i18n/id.json +++ b/console/src/assets/i18n/id.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Rahasia berhasil dihapus!" }, "MEMBERSHIPS": { - "TITLE": "Peran Manajer ZITADEL", + "TITLE": "Peran Administrator ZITADEL", "DESCRIPTION": "Ini semua adalah hibah anggota dari pengguna. Anda juga dapat memodifikasinya di halaman detail organisasi, proyek, atau IAM.", "ORGCONTEXT": "Anda melihat semua organisasi dan proyek yang terkait dengan organisasi yang dipilih saat ini.", "USERCONTEXT": "Anda melihat semua organisasi dan proyek yang Anda izinkan. Termasuk organisasi lain.", diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json index a7da9da81..08d618db3 100644 --- a/console/src/assets/i18n/it.json +++ b/console/src/assets/i18n/it.json @@ -1159,7 +1159,7 @@ "SECRETREMOVED": "Secret rimosso con successo!" }, "MEMBERSHIPS": { - "TITLE": "Memberships di ZITADEL", + "TITLE": "Ruoli dell'amministratore ZITADEL", "DESCRIPTION": "Questi sono tutti i member grant dell'utente. Puoi modificarli anche nelle pagine di dettaglio dell'organizzazione, del progetto o di sistema.", "ORGCONTEXT": "Vedi tutti i progetti che sono collegati all'organizzazione attualmente selezionata.", "USERCONTEXT": "Vedi tutte le organizzazioni e i progetti a cui sei autorizzato. Comprese le altre organizzazioni.", diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json index 46af7bb05..29f705748 100644 --- a/console/src/assets/i18n/mk.json +++ b/console/src/assets/i18n/mk.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Тајната е успешно отстранета!" }, "MEMBERSHIPS": { - "TITLE": "Улоги на ZITADEL менаџер", + "TITLE": "Улоги на администраторите на ZITADEL", "DESCRIPTION": "Овие се сите овластувања за членување на корисникот. Истите може да ги менувате и на страните за детали за организација, проект или IAM.", "ORGCONTEXT": "Ги гледате сите организации и проекти поврзани со тековно избраната организација.", "USERCONTEXT": "Ги гледате сите организации и проекти до кои имате овластување, вклучувајќи и други организации.", diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json index 512ff165c..c5a78f673 100644 --- a/console/src/assets/i18n/pl.json +++ b/console/src/assets/i18n/pl.json @@ -1159,7 +1159,7 @@ "SECRETREMOVED": "Sekret usunięty pomyślnie!" }, "MEMBERSHIPS": { - "TITLE": "Role menedżera ZITADEL", + "TITLE": "Role administratora ZITADEL", "DESCRIPTION": "To są wszystkie uprawnienia członków użytkownika. Możesz je również modyfikować na stronach szczegółów organizacji, projektu lub IAM.", "ORGCONTEXT": "Widzisz wszystkie organizacje i projekty, które są związane z aktualnie wybraną organizacją.", "USERCONTEXT": "Widzisz wszystkie organizacje i projekty, do których masz dostęp. Włączając inne organizacje.", diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json index a91e58701..c0306c86d 100644 --- a/console/src/assets/i18n/pt.json +++ b/console/src/assets/i18n/pt.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Segredo removido com sucesso!" }, "MEMBERSHIPS": { - "TITLE": "Funções de Gerente do ZITADEL", + "TITLE": "Funções de administrador do ZITADEL", "DESCRIPTION": "Essas são todas as permissões de membros do usuário. Você também pode modificá-las nas páginas de detalhes da organização, projeto ou IAM.", "ORGCONTEXT": "Você vê todas as organizações e projetos relacionados à organização atualmente selecionada.", "USERCONTEXT": "Você vê todas as organizações e projetos para os quais está autorizado. Incluindo outras organizações.", diff --git a/console/src/assets/i18n/ro.json b/console/src/assets/i18n/ro.json index 9ae8c77d7..a2404f856 100644 --- a/console/src/assets/i18n/ro.json +++ b/console/src/assets/i18n/ro.json @@ -1158,7 +1158,7 @@ "SECRETREMOVED": "Secret eliminat cu succes!" }, "MEMBERSHIPS": { - "TITLE": "Roluri de manager ZITADEL", + "TITLE": "Rolurile administratorilor ZITADEL", "DESCRIPTION": "Acestea sunt toate granturile de membru ale utilizatorului. Puteți să le modificați și în paginile de detalii ale organizației, proiectului sau IAM.", "ORGCONTEXT": "Vedeți toate organizațiile și proiectele care sunt legate de organizația selectată în prezent.", "USERCONTEXT": "Vedeți toate organizațiile și proiectele la care sunteți autorizat. Inclusiv alte organizații.", diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json index f35906fdf..de0d17070 100644 --- a/console/src/assets/i18n/ru.json +++ b/console/src/assets/i18n/ru.json @@ -1178,7 +1178,7 @@ "SECRETREMOVED": "Ключ успешно удален!" }, "MEMBERSHIPS": { - "TITLE": "Роли менеджера ZITADEL", + "TITLE": "Роли администратора ZITADEL", "DESCRIPTION": "Это все допуски пользователя. Вы также можете изменить их на страницах сведений об организации, проекте или в управлении идентификацией и доступом (IAM).", "ORGCONTEXT": "Вы видите все организации и проекты, связанные с выбранной в данный момент организацией.", "USERCONTEXT": "Вы видите все организации и проекты, в которых вы авторизованы. В том числе и другие организации.", diff --git a/console/src/assets/i18n/sv.json b/console/src/assets/i18n/sv.json index 07378c6ea..4b12ff82b 100644 --- a/console/src/assets/i18n/sv.json +++ b/console/src/assets/i18n/sv.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "Hemlighet borttagen framgångsrikt!" }, "MEMBERSHIPS": { - "TITLE": "ZITADEL Manager Roller", + "TITLE": "ZITADEL-administratörsroller", "DESCRIPTION": "Detta är alla medlemsbeviljanden för användaren. Du kan också ändra dem på organisations-, projekt- eller IAM-detaljsidor.", "ORGCONTEXT": "Du ser alla organisationer och projekt som är relaterade till den för närvarande valda organisationen.", "USERCONTEXT": "Du ser alla organisationer och projekt som du är auktoriserad till. Inklusive andra organisationer.", diff --git a/console/src/assets/i18n/uk.json b/console/src/assets/i18n/uk.json index 17146c8a4..c7a1e2f6a 100644 --- a/console/src/assets/i18n/uk.json +++ b/console/src/assets/i18n/uk.json @@ -1161,7 +1161,7 @@ "SECRETREMOVED": "Секрет видалено успішно!" }, "MEMBERSHIPS": { - "TITLE": "Ролі менеджера ZITADEL", + "TITLE": "Ролі адміністратора ZITADEL", "DESCRIPTION": "Це всі гранти членства користувача. Ви також можете змінювати їх на сторінках деталей організації, проекту або IAM.", "ORGCONTEXT": "Ви бачите всі організації та проекти, пов'язані з поточно обраною організацією.", "USERCONTEXT": "Ви бачите всі організації та проекти, до яких у вас є авторизація. Включаючи інші організації.", diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json index 75647aa99..0489a7554 100644 --- a/console/src/assets/i18n/zh.json +++ b/console/src/assets/i18n/zh.json @@ -1160,7 +1160,7 @@ "SECRETREMOVED": "秘密被成功删除!" }, "MEMBERSHIPS": { - "TITLE": "ZITADEL 管理角色", + "TITLE": "ZITADEL 管理员角色", "DESCRIPTION": "这些都是用户成员授权。您还可以在组织、项目或 IAM 详细信息页面上修改它们。", "ORGCONTEXT": "您会看到与当前所选组织相关的所有组织和项目。", "USERCONTEXT": "您会看到您被授权的所有组织和项目。包括其他组织。", diff --git a/docs/docs/concepts/features/selfservice.md b/docs/docs/concepts/features/selfservice.md index c93aa695f..96057a66e 100644 --- a/docs/docs/concepts/features/selfservice.md +++ b/docs/docs/concepts/features/selfservice.md @@ -4,12 +4,12 @@ sidebar_label: Self Service --- ZITADEL allows users to perform many tasks themselves. -For these tasks we either provide an user interface, or the tasks can be initiated or completed through ZITADEL's APIs. +For these tasks we either provide a user interface, or the tasks can be initiated or completed through ZITADEL's APIs. It is important to understand that, depending on your use case, there will exist different user-types that want to perform different actions: -- `Users` are the end-users of your application. Like with any CIAM solution, users should be able to perform tasks like register/join, update their profile, manage authenticators etc. There are certain actions that can be executed pre-login, yet others require the user to have a valid session. -- `Managers` are users with a [special manager role](../../guides/manage/console/managers) within ZITADEL and can perform administrative actions such as system configuration or granting access rights to users. +- `Users` are the end-users of your application. Like with any CIAM solution, users should be able to perform tasks like register/join, update their profile, manage authenticators, etc. There are certain actions that can be executed pre-login, yet others require the user to have a valid session. +- `Managers` are users with a [special administrator role](../../guides/manage/console/managers) within ZITADEL and can perform administrative actions such as system configuration or granting access rights to users. All self-service interfaces are available in different [languages](/guides/manage/customize/texts#internationalization--i18n). @@ -22,7 +22,7 @@ ZITADEL covers the typical "CIAM" self-service capabilities as well as delegated :::info You can pre-select a given organization by passing the scope `urn:zitadel:iam:org:domain:primary:{domainname}` in the authorization request. This will force users to register only with the specified organization. -Furthermore the branding and login settings (e.g. Social Login Providers) are directly shown to the user. +Furthermore, the branding and login settings (e.g., Social Login Providers) are directly shown to the user. ::: ### Local account @@ -32,11 +32,11 @@ Allows anonymous users and authenticated users, who are not yet in the given org - Mandatory profile fields - Set password - Accept terms of service and privacy policy -- User receives an email with an one-time code for verification purpose +- User receives an email with a one-time code for verification purpose - User has to enter the one-time code to finish registration - User can re-request a new one-time code -The user is prompted on first login to setup MFA. +The user is prompted on the first login to set up MFA. This step can be made mandatory if MFA is enforced in the login policy. ### Existing Identity / SSO / Social Login @@ -50,10 +50,10 @@ An external identity provider can be a Social Login Provider or a pre-configured #### Account Linking -When you login with an external identity provider, and the user does not exist in ZITADEL, then an autoregister flow is triggered. The user is presented with two options: +When you log in with an external identity provider, and the user does not exist in ZITADEL, then an autoregister flow is triggered. The user is presented with two options: - Create a new account: A new account will be created as stated above -- Autolinking: The user is prompted to login with an existing [local account](#local-account). If successful, the existing identity from the external identity provider will be linked with the local account. A user can now login with either the local account or any of the linked external accounts. +- Autolink: The user is prompted to log in with an existing [local account](#local-account). If successful, the existing identity from the external identity provider will be linked with the local account. A user can now log in with either the local account or any of the linked external accounts. ## Login @@ -61,19 +61,19 @@ When you login with an external identity provider, and the user does not exist i Given an external identity provider is configured on the instance or on the organization, then: -- the user will be shown a button for each identity provider as alternative to login with a [local account](#local-account) -- when clicking the button the user will be redirected to the identity provider -- after successful login the user will be redirected to the application +- the user will be shown a button for each identity provider as an alternative to log in with a [local account](#local-account) +- when clicking the button, the user will be redirected to the identity provider +- after successful login, the user will be redirected to the application ### Machines -Machine accounts can't use an interactive login but require other means of authentication, such as privately-signed JWT or personal access tokens. +Machine accounts can't use an interactive login but require other means of authentication, such as privately signed JWT or personal access tokens. Read more about [Service Users](/guides/integrate/service-users/authenticate-service-users) and recommended [OpenID Connect Flows](/guides/integrate/login/oidc/oauth-recommended-flows#different-client-profiles). ## Logout Users can terminate the session for all their users (logout). -A client can also implement this, by calling the [specific endpoint](/apis/openidoauth/endpoints#end_session_endpoint). +A client can also implement this by calling the [specific endpoint](/apis/openidoauth/endpoints#end_session_endpoint). ## Profile @@ -88,7 +88,7 @@ The current password must be entered first. ### MFA / FIDO Passkeys -Users can setup and delete a second factor and FIDO Passkeys (Passwordless). +Users can set up and delete a second factor and FIDO Passkeys (Passwordless). Available authenticators are: - Time-based one-time password (TOTP) (Which are Authenticator Apps like Google/Microsoft Authenticator, Authy, etc.) @@ -123,24 +123,24 @@ The user receives a one-time password and can verify control over the given phon ### Identity providers Users can create a connection between a [local user account](#local-account) and an [external identity](#existing-identity--sso--social-login). -The user can login with any of the linked accounts. +The user can log in with any of the linked accounts. [Linking of external accounts](#account-linking) is done during the login process. ## Managers It is important to note that a `Manager` is not simply an administrative user, but can be used to create much more advanced scenarios such as delegating administration of a whole organization to a user, acting then as administrator and permission manager of that user group. -Thus we will explain service for two very common scenarios in ZITADEL: +Thus, we will explain service for two of the most common scenarios in ZITADEL: - `Managers in isolation`: Granting administrative permissions within a single organization context. - `Managers in delegation`: Granting administrative permissions to a user from a different organization where the organizations depend on each other -A list of [Manager Roles](../../guides/manage/console/managers#roles) is available with a description of permissions. -Managers can be assigned to both human users and service users eg, for managing certain tasks programmatically. +A list of [Administrator Roles](../../guides/manage/console/managers#roles) is available with a description of permissions. +Managers can be assigned to both human users and service users, e.g., for managing certain tasks programmatically. ### Managers in isolation -An user with the Manager roles `IAM_OWNER` or `ORG_OWNER` might want to assign other users from their organization elevated permissions to handle certain aspects of the IAM tasks. +A user with Administrator roles `IAM_OWNER` or `ORG_OWNER` might want to assign other users from their organization elevated permissions to handle certain aspects of the IAM tasks. This could be permission to assign authorizations within this isolated organization (`ORG_USER_MANAGER`) or handling setup of projects and applications (`PROJECT_OWNER`). ### Managers in delegation @@ -148,9 +148,9 @@ This could be permission to assign authorizations within this isolated organizat In a setup like described in the [B2B Scenario](/guides/solution-scenarios/b2b), there exists an organization of the project owner and a customer organization. The project is granted to the customer organization, such that the customer can access the project and assign authorization to their users. -Given such as setup the owner might want to give one administrative user of the customer organization the role `ORG_OWNER`. -Equipped with this Manager Role, the user can perform actions like configuring their own SSO/Identity Provider, set security policy for their organization, customize branding, or assign project or Manager roles to other users. +Given such as set up the owner might want to give one administrative user of the customer organization the role `ORG_OWNER`. +Equipped with this Administrator Role, the user can perform actions like configuring their own SSO/Identity Provider, set security policy for their organization, customize branding, or assign project or Administrator roles to other users. -An `ORG_OWNER` can also not only delegate Manager roles to other users [as described in the earlier section](#managers-in-isolation) but also manage all aspects of their own organization as well as authorize users to use the granted project. +An `ORG_OWNER` can also not only delegate Administrator roles to other users [as described in the earlier section](#managers-in-isolation) but also manage all aspects of their own organization as well as authorize users to use the granted project. With ZITADEL there is no need to replicate all settings and projects across organizations. -Instead you set-up the project in one organization, delegate it to different organizations, and then appoint users as Managers of that organization to allow for self-service in a multi-tenancy scenario. +Instead, you could set up the project in one organization, delegate it to different organizations, and then appoint users as Managers of that organization to allow for self-service in a multi-tenancy scenario. diff --git a/docs/docs/concepts/structure/_manager_description.mdx b/docs/docs/concepts/structure/_manager_description.mdx index 31a207a2e..59aacda42 100644 --- a/docs/docs/concepts/structure/_manager_description.mdx +++ b/docs/docs/concepts/structure/_manager_description.mdx @@ -2,11 +2,11 @@ Managers are [human users or service users](/docs/guides/manage/console/users-ov Manager permissions can be assigned to different levels in ZITADEL: -- **IAM Managers**: This is the highest level. Users with IAM Manager roles are able to manage the whole [Instance](/docs/concepts/structure/instance). +- **IAM Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole [Instance](/docs/concepts/structure/instance). - **Org Managers**: Managers in the Organization Level are able to view or manage everything, according to their permissions, within the granted [Organization](/docs/guides/manage/console/organizations-overview). - **Project Mangers**: In this level the user is able to manage a [project](/docs/guides/manage/console/projects-overview). - **Project Grant Manager**: The project grant manager is for [granted projects](/docs/concepts/structure/granted_projects) by another organization. -Scope of the managers is restricted based on their level. -That means a Manager, assigned to one organization, will only get access to resources and configurations of that organization. -Only Managers on the instance level can view resources, such as users, across all organizations. +The scope of the managers is restricted based on their level. +Which means that a Manager, assigned to one organization, will have access only to the resources and configurations of that organization. +Only the Managers on the instance level can view resources, such as users, across all organizations. diff --git a/docs/docs/concepts/structure/applications.md b/docs/docs/concepts/structure/applications.md index 22fe81787..31c8d5756 100644 --- a/docs/docs/concepts/structure/applications.md +++ b/docs/docs/concepts/structure/applications.md @@ -19,7 +19,7 @@ ZITADEL supports the following client types: Ensure the configuration of application settings is limited to authorized users only. -- Use [Manager roles](managers.mdx) to limit permissions for your users to make changes to your applications +- Use [Administrator roles](managers.mdx) to limit permissions for your users to make changes to your applications - When [granting projects](granted_projects.md) to other organizations, the receiving organization can't see or change application configuration ## References diff --git a/docs/docs/concepts/structure/managers.mdx b/docs/docs/concepts/structure/managers.mdx index 194a34d7b..220f5c32b 100644 --- a/docs/docs/concepts/structure/managers.mdx +++ b/docs/docs/concepts/structure/managers.mdx @@ -10,5 +10,5 @@ import ManagerDescription from "./_manager_description.mdx"; Notes: -- Read our [guide on Managers](../../guides/manage/console/managers) to learn more about the role concept and how to use Manager roles in ZITADEL. -- [API reference](/docs/apis/resources/mgmt/management-service-list-org-member-roles) for Managers on organization level +- Read our [guide on Managers](../../guides/manage/console/managers) to learn more about the role concept and how to use Administrator roles in ZITADEL. +- [API reference](/docs/apis/resources/mgmt/management-service-list-org-member-roles) for Managers on the organization level diff --git a/docs/docs/concepts/structure/users.md b/docs/docs/concepts/structure/users.md index 8d512d744..8e8efb2de 100644 --- a/docs/docs/concepts/structure/users.md +++ b/docs/docs/concepts/structure/users.md @@ -29,7 +29,7 @@ Learn how to [use service users](/docs/guides/integrate/service-users/authentica ### Managers Any user, human or service user, can be given a [Manager](/concepts/structure/managers) role. -Given a manager role, a user is not only an end-user of ZITADEL but can also manage certain aspects of ZITADEL itself. +A user with an administrator role is not only an end-user of ZITADEL but can also manage certain aspects of ZITADEL itself. ### Federated users diff --git a/docs/docs/examples/login/nextjs-b2b.md b/docs/docs/examples/login/nextjs-b2b.md index 7623ffc45..4668afc5e 100644 --- a/docs/docs/examples/login/nextjs-b2b.md +++ b/docs/docs/examples/login/nextjs-b2b.md @@ -138,12 +138,12 @@ Let's call this new organization `Demo-Customer`. Now switch back to the organization `Demo-Customer` and [create a new user](/guides/manage/console/users-overview#create-user) in this organization. Let's call the first user `Alice Admin`. Create a second user called `Eric Employee`. -### Manager Role +### Administrator Role We want to enable Alice to assign roles to users in her organization in a self-service manner. -To make this happen, we need give Alice an [Manager Role](/concepts/structure/managers) within the Organization `Demo-Customer`. +To make this happen, we need to assign Alice an [Administrator Role](/concepts/structure/managers) within the Organization `Demo-Customer`. -Still in the organization `Demo-Customer`, navigate to Organization. Click on the plus on the top right and give `Alice Admin` the Manager Role `Org Owner`. +Still in the organization `Demo-Customer`, navigate to Organization. Click on the plus on the top right and give `Alice Admin` the Administrator Role `Org Owner`. Login with your user on the customer organization to validate the setup. diff --git a/docs/docs/examples/login/symfony.md b/docs/docs/examples/login/symfony.md index b07acf44c..195491845 100644 --- a/docs/docs/examples/login/symfony.md +++ b/docs/docs/examples/login/symfony.md @@ -320,8 +320,8 @@ https://github.com/zitadel/example-symfony-oidc/blob/main/templates/profile.html #### User list -The user list controller displays all users from the database, that were created during OIDC login. -Only users with an admin role will have access to this page. +The user list controller displays all users from the database that were created during OIDC login. +Only users with an administrator role will have access to this page. ```php reference https://github.com/zitadel/example-symfony-oidc/blob/main/src/Controller/UserListController.php @@ -392,10 +392,10 @@ symfony server:start --no-tls ``` Visit http://localhost:8000 and click around. -When you go to profile you will be redirected to login your user on ZITADEL. -After login you should see some profile data of the current user. -Upon clicking logout you are redirected to the homepage. -Now you can click "users" and login with an account that has the admin role. +When you go to profile, you will be redirected to login your user on ZITADEL. +After login, you should see some profile data of the current user. +Upon clicking logout, you are redirected to the homepage. +Now you can click "users" and log in with an account that has the administrator role. ## Completion diff --git a/docs/docs/examples/secure-api/go.md b/docs/docs/examples/secure-api/go.md index ef0a7fa9c..7e9eac2bc 100644 --- a/docs/docs/examples/secure-api/go.md +++ b/docs/docs/examples/secure-api/go.md @@ -197,7 +197,7 @@ Content-Length: 50 permission denied: missing required role: `admin` ``` -### Add admin role +### Add administrator role So let's create the role and grant it to the user. To do so, go to your project in ZITADEL Console and create the role by selecting `Roles` in the navigation and then clicking on the `New Role` button. diff --git a/docs/docs/examples/secure-api/java-spring.md b/docs/docs/examples/secure-api/java-spring.md index 1f4ddc778..cc33d681f 100644 --- a/docs/docs/examples/secure-api/java-spring.md +++ b/docs/docs/examples/secure-api/java-spring.md @@ -218,7 +218,7 @@ Content-Length: 0 Date: Mon, 15 Jan 2024 09:24:39 GMT ``` -### Add admin role +### Add administrator role So let's create the role and grant it to the user. To do so, go to your project in ZITADEL Console and create the role by selecting `Roles` in the navigation and then clicking on the `New Role` button. diff --git a/docs/docs/guides/integrate/onboarding/b2b.mdx b/docs/docs/guides/integrate/onboarding/b2b.mdx index e0e4945b6..2208fd849 100644 --- a/docs/docs/guides/integrate/onboarding/b2b.mdx +++ b/docs/docs/guides/integrate/onboarding/b2b.mdx @@ -27,7 +27,7 @@ ZITADEL does have multiple possibilities to achieve that process. Each ZITADEL instance does automatically bring a management console with it. The [console](/docs/guides/manage/console/console-overview) can be used to manage all your resources through a UI. You can access it by calling the following URL: `${CUSTOM-DOMAIN}/ui/` -Make sure that your admins have a [Manager role](/docs/guides/manage/console/managers) with permissions on an instance level such as "INSTANCE_OWNER" +Make sure that your admins have a [Administrator role](/docs/guides/manage/console/managers) with permissions on an instance level such as "INSTANCE_OWNER" ### Create a customer @@ -58,9 +58,9 @@ import CreateUser from '/docs/guides/manage/console/_create-user.mdx'; -#### Add Manager Role to User +#### Add Administrator Role to User -Now you need to give the right manager role to your user. In this case we want to give "ORG_OWNER". +Now you need to assign the right administrator role to your user. In this case we want to give "ORG_OWNER". If you do want to know more about the roles check out the [ZITADEL Managers Guide with the Role List](/docs/guides/manage/console/managers) Go to the detail page of the organization and select the "+" button in the top right corner, where you already see a list of existing managers. diff --git a/docs/docs/guides/integrate/retrieve-user-roles.md b/docs/docs/guides/integrate/retrieve-user-roles.md index e71a462a7..277b76a52 100644 --- a/docs/docs/guides/integrate/retrieve-user-roles.md +++ b/docs/docs/guides/integrate/retrieve-user-roles.md @@ -6,24 +6,24 @@ sidebar_label: Retrieve User Roles This guide explains all the possible ways of retrieving user roles across different organizations and projects using ZITADEL's APIs. ## What are roles/authorizations/grants in ZITADEL? -User roles, user grants, or authorizations refer to the roles that are assigned to a user. These terms are used interchangeably to mean the roles assigned to the user, e.g., the ZITADEL Console refers to the pairing of roles and users as authorizations, whereas the APIs refer to them as grants. This guide will use the term roles for application-specific roles (e.g., `admin`, `accountant`, `employee`, `hr`, etc.) and ZITADEL-specific manager roles (e.g., `IAM_OWNER`, `ORG_OWNER`, `PROJECT_OWNER`, etc.). +User roles, user grants, or authorizations refer to the roles that are assigned to a user. These terms are used interchangeably to mean the roles assigned to the user, e.g., the ZITADEL Console refers to the pairing of roles and users as authorizations, whereas the APIs refer to them as grants. This guide will use the term roles for application-specific roles (e.g., `admin`, `accountant`, `employee`, `hr`, etc.) and ZITADEL-specific administrator roles (e.g., `IAM_OWNER`, `ORG_OWNER`, `PROJECT_OWNER`, etc.). Roles are critical to managing permissions in a single-tenant or multi-tenant application. It can, however, be tricky to retrieve them, especially when spanning multiple organizations and projects. ## Assign roles and memberships -Human or service users can be assigned roles. You can do this via the ZITADEL Console or the ZITADEL APIs. As mentioned earlier, there are two types of roles in ZITADEL. You can have your own application-specific roles, and alternatively, ZITADEL also has manager roles, such as `ORG_OWNER` and `IAM_OWNER`. +Human or service users can be assigned roles. You can do this via the ZITADEL Console or the ZITADEL APIs. As mentioned earlier, there are two types of roles in ZITADEL. You can have your own application-specific roles, and alternatively, ZITADEL also has administrator roles, such as `ORG_OWNER` and `IAM_OWNER`. Follow the links below to assign roles to your users. - [Add application roles via the ZITADEL Console](/docs/guides/manage/console/roles) -- [Add manager roles via the ZITADEL Console](/docs/guides/manage/console/managers) +- [Add administrator roles via the ZITADEL Console](/docs/guides/manage/console/managers) - [Add application roles via the ZITADEL Management API](/docs/category/apis/resources/mgmt/project-roles) -- [Add manager roles to users via the ZITADEL Management API](/docs/category/apis/resources/mgmt/members) +- [Add administrator roles to users via the ZITADEL Management API](/docs/category/apis/resources/mgmt/members) ## Retrieve roles -Roles can be requested via our auth and management APIs, from userinfo endpoint or ID token. Currently, manager roles cannot be directly included in the token. You will need to use the ZITADEL APIs to retrieve them. +Roles can be requested via our auth and management APIs, from userinfo endpoint or ID token. Currently, administrator roles cannot be directly included in the token. You will need to use the ZITADEL APIs to retrieve them. ### Generate a token @@ -248,7 +248,7 @@ curl -L -X POST 'https://${CUSTOM_DOMAIN}/auth/v1/permissions/me/_search' \ #### **2.[List my ZITADEL permissions](/docs/apis/resources/auth/auth-service-list-my-zitadel-permissions)​** -Returns a list of permissions the authenticated user has in ZITADEL based on the manager roles the user has. (e.g: `ORG_OWNER` = `org.read`, `org.write`, ...). +Returns a list of permissions the authenticated user has in ZITADEL based on the administrator roles the user has. (e.g: `ORG_OWNER` = `org.read`, `org.write`, ...). This request can be used if you are building a management UI. For instance, if the UI is managing users, you can show the management functionality based on the permissions the user has. Here’s an example: if the user has `user.read` and `user.write` permission you can show the edit buttons, if the user only has `user.read` permission, you can hide the edit buttons. diff --git a/docs/docs/guides/integrate/zitadel-apis/access-zitadel-apis.md b/docs/docs/guides/integrate/zitadel-apis/access-zitadel-apis.md index 14fa3a5d8..7b3ea9583 100644 --- a/docs/docs/guides/integrate/zitadel-apis/access-zitadel-apis.md +++ b/docs/docs/guides/integrate/zitadel-apis/access-zitadel-apis.md @@ -28,13 +28,13 @@ For further details and in-depth exploration, you can refer to the [ZITADEL API Accessing ZITADEL APIs, except for the Auth API and the System API, requires these basic steps: 1. **Create a service user**: A service user is a special type of account used to grant programmatic access to ZITADEL's functionalities. Unlike regular users who log in with a username and password, [service users rely on a more secure mechanism involving digital keys and tokens](../service-users/authenticate-service-users). -2. **Give permission to access ZITADEL APIs**: Assign a Manager role to the service user, giving it permission to make changes to certain resources in ZITADEL. +2. **Give permission to access ZITADEL APIs**: Assign a Administrator role to the service user, giving it permission to make changes to certain resources in ZITADEL. 3. **Authenticate the service user**: Like human users, service users must authenticate and request an OAuth token with the scope `urn:zitadel:iam:org:project:id:zitadel:aud` to access ZITADEL APIs. [Service users can be authenticated](../service-users/authenticate-service-users) using private key JWT, client credentials, or personal access tokens. 4. **Access ZITADEL APIs with the token**: The OAuth token must be included in the Authorization Header of calls to ZITADEL APIs. ### Accessing Auth API -The Auth API can be used for all operations on the requesting user, meaning the user id in the sub claim of the used token. +The Auth API can be used for all operations on the requesting user, meaning the user id in the `sub` claim of the used token. Using this API doesn't require a service user to be authenticated. Instead, you call the Auth API with the token of the user. @@ -62,17 +62,17 @@ Via APIs: * [Create User (Machine)](/docs/apis/resources/mgmt/management-service-add-machine-user) -## 2. Grant a Manager role to the service user +## 2. Grant an Administrator Role to the Service User ZITADEL Managers are Users who have permission to manage ZITADEL itself. There are some different levels for managers. -- **IAM Managers**: This is the highest level. Users with IAM Manager roles are able to manage the whole instance. +- **IAM Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole instance. - **Org Managers**: Managers in the Organization Level are able to manage everything within the granted Organization. - **Project Managers**: At this level, the user is able to manage a project. - **Project Grant Manager**: The project grant manager is for projects, which are granted of another organization. -On each level, we have some different Roles. Here you can find more about the different roles: [ZITADEL Manager Roles](/guides/manage/console/managers#roles) +There are different roles on each level. You can find more about the different roles here: [ZITADEL Administrator Roles](/guides/manage/console/managers#roles) To be able to access the ZITADEL APIs your service user needs permissions to ZITADEL. diff --git a/docs/docs/guides/integrate/zitadel-apis/event-api.md b/docs/docs/guides/integrate/zitadel-apis/event-api.md index f055adffd..ff274c46e 100644 --- a/docs/docs/guides/integrate/zitadel-apis/event-api.md +++ b/docs/docs/guides/integrate/zitadel-apis/event-api.md @@ -7,7 +7,7 @@ ZITADEL leverages the power of eventsourcing, meaning every action and change wi To provide you with greater flexibility and access to these events, ZITADEL has introduced an Event API. This API allows you to easily retrieve and utilize the events generated within the system, enabling you to integrate them into your own system and respond to specific events as they occur. -You need to give a user the [manager role](/docs/guides/manage/console/managers) IAM_OWNER_VIEWER or IAM_OWNER to access the Event API. +You need to assign a user the [administrator role](/docs/guides/manage/console/managers) IAM_OWNER_VIEWER or IAM_OWNER to access the Event API. If you like to know more about eventsourcing/eventstore and how this works in ZITADEL, head over to our [concepts](/docs/concepts/eventstore/overview). ## Request Events diff --git a/docs/docs/guides/manage/console/applications-overview.mdx b/docs/docs/guides/manage/console/applications-overview.mdx index 00f110098..269c467ab 100644 --- a/docs/docs/guides/manage/console/applications-overview.mdx +++ b/docs/docs/guides/manage/console/applications-overview.mdx @@ -178,7 +178,7 @@ If your application makes requests from domains other than the Redirect URI (e.g Ensure the configuration of application settings is limited to authorized users only. -* Use [Manager roles](./managers) to limit permissions for your users to make changes to your applications. +* Use [Administrator roles](./managers) to limit permissions for your users to make changes to your applications. * When [granting projects](../../../concepts/structure/granted_projects.md) to other organizations, the receiving organization **cannot** see or change the application configuration. They can only assign roles. ## References diff --git a/docs/docs/guides/manage/console/console-overview.mdx b/docs/docs/guides/manage/console/console-overview.mdx index 295c8bdc7..90eb274b3 100644 --- a/docs/docs/guides/manage/console/console-overview.mdx +++ b/docs/docs/guides/manage/console/console-overview.mdx @@ -40,7 +40,7 @@ The Console enables administrators to perform the following critical tasks: 2. **Resource Management:** Create, update, and delete essential resources such as [Organizations](./organizations-overview), [Projects](./projects-overview), and [Applications](./applications-overview). 3. **User Management:** Manage the lifecycle of [User accounts](./users-overview). This includes creating new users, updating profiles, resetting passwords, and deactivating accounts. 4. **Access Control:** Define and manage permissions. Administrators can assign [Roles](/docs/guides/manage/console/roles) to users and configure fine-grained access controls for specific resources. -5. **Manager Assignment:** Delegate administrative tasks by assigning **Manager** roles (e.g., Org Owner, Project Owner) to specific users, ensuring proper oversight and segregation of duties. +5. **Manager Assignment:** Delegate administrative tasks by assigning **Administrator** roles (e.g., Org Owner, Project Owner) to specific users, ensuring proper oversight and segregation of duties. 6. **Customization and Branding:** Customize the look and feel of ZITADEL. You can upload custom logos, select color schemes, and apply [branding](/docs/guides/manage/customize/branding) to match your corporate identity. 7. **Audit Logging:** Access [Audit Logs](/docs/concepts/features/audit-trail) to track user activity and configuration changes. This is essential for monitoring security events and maintaining regulatory compliance. @@ -54,4 +54,4 @@ Please follow the [Restrict Console Access guide](/docs/guides/solution-scenario ## References -* [Manager Roles Concept](/docs/concepts/structure/managers) \ No newline at end of file +* [Administrator Roles Concept](/docs/concepts/structure/managers) \ No newline at end of file diff --git a/docs/docs/guides/manage/console/users-overview.mdx b/docs/docs/guides/manage/console/users-overview.mdx index 7150c951c..a95d0cb99 100644 --- a/docs/docs/guides/manage/console/users-overview.mdx +++ b/docs/docs/guides/manage/console/users-overview.mdx @@ -40,8 +40,8 @@ In a multi-tenancy architecture, users are typically isolated within [Organizati However, using [External User Grants](../../../concepts/features/external-user-grant), an organization can invite users from *another* organization to access their projects. These invited users are referred to as **External Users** within the context of the inviting organization. ### Managers -Any user—whether Human or Service User—can be assigned a [Manager Role](/concepts/structure/managers). -A user with a manager role is not just an end-user of your application but also has permissions to manage specific aspects of the ZITADEL instance, organization, or project (e.g., `ORG_OWNER`, `PROJECT_OWNER`). +Any user—whether Human or Service User—can be assigned an [Administrator Role](/concepts/structure/managers). +A user with an administrator role is not just an end-user of your application but also has permissions to manage specific aspects of the ZITADEL instance, organization, or project (e.g., `ORG_OWNER`, `PROJECT_OWNER`). ## Considerations diff --git a/docs/docs/guides/solution-scenarios/b2b.mdx b/docs/docs/guides/solution-scenarios/b2b.mdx index b6a8f6c3f..1f652f8cc 100644 --- a/docs/docs/guides/solution-scenarios/b2b.mdx +++ b/docs/docs/guides/solution-scenarios/b2b.mdx @@ -71,10 +71,10 @@ In our scenario, Octagon creates a project grant for Pentagon. Pentagon is limit In this scenario, Dimitri and Michael share the same organization Pentagon, where as Bill belongs to Octagon. Octagon is owner of the Portal project with its Web App, having Bill configured as user grant with `admin` role. Dimitri owns the `writer` role, whereas Michael only is `reader`. -> Note: Roles are meant for internal business logic and therefore need to be validated separately, none of the users described are allowed to create user grants, at least if they do not own a ZITADEL manager role. +> Note: Roles are meant for internal business logic and therefore need to be validated separately, none of the users described are allowed to create user grants, at least if they do not own a ZITADEL administrator role. If you made a dashboard where some users are able to create user grants, the Management API to do such operations should be triggered with the personal access token of the users, not with a token of a machine user, to create a meaningful audit log. -If you had such a use case, ZITADEL manager roles must be assigned to those users. +If you had such a use case, ZITADEL administrator roles must be assigned to those users. ### Noteworthy diff --git a/docs/docs/guides/solution-scenarios/restrict-console.mdx b/docs/docs/guides/solution-scenarios/restrict-console.mdx index 7c352f216..6ae1a18ca 100644 --- a/docs/docs/guides/solution-scenarios/restrict-console.mdx +++ b/docs/docs/guides/solution-scenarios/restrict-console.mdx @@ -9,11 +9,11 @@ In some use cases you want to prevent users from accessing the console, this cou - Users login via SSO and should not be able to change their data in the Console - Only managers should be able to access Console to manage their users -At the moment it is not possible to simply disable the Console but with the configuration described in this guide you can prevent users from accessing the Console. +At the moment it is not possible to simply disable the Console, but with the configuration described in this guide, you can prevent users from accessing the Console. ## Self-hosted -If you are running ZITADEL self-hosted we recommend to restrict the access to ZITADEL Console via WAF/reverse-proxy for Non-Manager users +If you are running ZITADEL self-hosted, we recommend restricting the access to ZITADEL Console via WAF/reverse-proxy for Non-Manager users ## ZITADEL Cloud (and self-hosted) @@ -27,7 +27,7 @@ Read more about how to set the default redirect URI: [Settings - Default Redirec ### Restricting Console in default-project -With this workaround, you will limit users from accessing the [default-project](/docs/guides/manage/console/projects-overview#the-default-project), if they are not explicitly granted to use this project. +With this workaround, you will limit users from accessing the [default-project](/docs/guides/manage/console/projects-overview#the-default-project) if they are not explicitly granted to use this project. When setting the "Check for Project on Authentication" setting on a project, only users of organizations with a grant to that project can access it. By default, this setting is disabled, so all users can access the project. @@ -41,7 +41,7 @@ Start by granting the organization of your managers, that should be able to acce 2. On the next screen select the organization to which you want to give the grant ![Project Settings: Grants - Choose Organization](/img/guides/solution-scenarios/console-create-project-grant-org.png) -3. You can skip the screen with the role selection, and click save +3. You can skip the screen with the role selection and click save 4. Make sure the grant is in now in the overview and marked as active. To avoid accidental lock-out, the [default project](/docs/guides/manage/console/projects-overview#the-default-project) hides the checkbox "Check Project on Authentication" in the Console: @@ -49,11 +49,11 @@ To avoid accidental lock-out, the [default project](/docs/guides/manage/console/ You need to use the [update project API call](/docs/apis/resources/mgmt/management-service-update-project) to set the configuration on the project. -First you need a user with manager permissions to change the project settings in that organization. +First, you need a user with manager permissions to change the project settings in that organization. This means either you add the manager to the organization or you use a manager on the instance level with "IAM-OWNER" permissions. After that create a Personal Access Token (PAT) for the manager. -More detailed information about creating a PAT and manager roles you can find [here](/docs/guides/integrate/service-users/personal-access-token) +More detailed information about creating a PAT and administrator roles you can find [here](/docs/guides/integrate/service-users/personal-access-token) Then you have to send the following request: ```bash @@ -73,9 +73,9 @@ curl -L -X PUT "https://${CUSTOM_DOMAIN}/management/v1/projects/${PROJECT_ID}" \ Where - `${CUSTOM_DOMAIN}` is your Custom Domain, f.e. mydemo.zitadel.cloud - `${PAT}` is your service user's personal access token -- `${PROJECT_ID}` is the default-project's ID that can be found in Console, see screenshot above +- `${PROJECT_ID}` is the default-project's ID that can be found in Console see screenshot above -You should now be able to login with users of organization that have the grant (in this example users of the organization "Customer-A"). +You should now be able to log in with users of the organization that have the grant (in this example users of the organization "Customer-A"). All other users should see the following error message after authentication: ![Console access restricted](/img/guides/solution-scenarios/console-access-restricted.png) diff --git a/docs/docs/sdk-examples/go.mdx b/docs/docs/sdk-examples/go.mdx index 77e11f37d..97f483774 100644 --- a/docs/docs/sdk-examples/go.mdx +++ b/docs/docs/sdk-examples/go.mdx @@ -70,7 +70,7 @@ What does the API Application Example include: - REST API Application secured with Spring Security and OAuth2 - Public Endpoint: Accessible without authentication - Private Endpoint: Accessible with a token -- Administrator Endpoint: Accessible with a token of a user with admin role +- Administrator Endpoint: Accessible with a token of a user with an administrator role [Example API App](https://github.com/zitadel/zitadel-go/tree/next/example/api/http) diff --git a/docs/docs/sdk-examples/java.mdx b/docs/docs/sdk-examples/java.mdx index e4862422d..2db6f44e9 100644 --- a/docs/docs/sdk-examples/java.mdx +++ b/docs/docs/sdk-examples/java.mdx @@ -54,7 +54,7 @@ What does the Web Application Example include: - Authenticating user with OIDC PKCE Flow - Public Page: Accessible without authentication - Private Page: Shows user information of authenticated user, only accessible after login -- Task Page: Only accessible after login and uses the API example. Requires the admin role for the application for some interaction. +- Task Page: Only accessible after login and uses the API example. Requires the administrator role for the application for some interaction. - Logout [Example Web App with Spring Security](https://github.com/zitadel/zitadel-java/web) @@ -65,7 +65,7 @@ What does the API Application Example include: - REST API Application secured with Spring Security and OAuth2 - Public Endpoint: Accessible without authentication - Private Endpoint: Accessible with a token -- Administrator Endpoint: Accessible with a token of a user with admin role +- Administrator Endpoint: Accessible with a token of a user with an administrator role [Example API App with Spring Security](https://github.com/zitadel/zitadel-java/api) @@ -77,12 +77,12 @@ The guides lead you through the whole process from configuring the right applica #### Web Application Guide -After completing the Step-By-Step Guide you will have: +After completing the Step-By-Step Guide, you will have: 1. Example Web Application with integrated ZITADEL Login 2. Example page accessible by authenticated user showing retrieved user information -3. Example page accessible by authenticated user showing task list - - Task list can be read by authenticated user - - New tasks can be created by user with admin role +3. Example page accessible by an authenticated user showing a task list + - Task list can be read by an authenticated user + - New tasks can be created by a user with an administrator role 4. Logout 5. Correct setup for your application in ZITADEL @@ -91,11 +91,11 @@ After completing the Step-By-Step Guide you will have: #### API Application Guide -After completing the Step-By-Step Guide you will have: +After completing the Step-By-Step Guide, you will have: 1. Example REST API checking tokens against ZITADEL with OAuth2 2. Public Endpoint accessible by any user 3. Private Endpoint accessible by authenticated user -4. Private Endpoint accessible by user with role 'admin' +4. Private Endpoint accessible by the user with the role 'admin' 5. Correct setup for your application in ZITADEL [API APP Step-By-Step Guide](/docs/examples/secure-api/java-spring) diff --git a/proto/zitadel/auth.proto b/proto/zitadel/auth.proto index a9046637d..fef43bed6 100644 --- a/proto/zitadel/auth.proto +++ b/proto/zitadel/auth.proto @@ -908,7 +908,7 @@ service AuthService { option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { tags: "User Authorizations/Grants" summary: "List My ZITADEL Permissions"; - description: "Returns a list of permissions the authenticated user has in ZITADEL based on the manager roles the user has. (e.g: ORG_OWNER = org.read, org.write, ...)." + description: "Returns a list of permissions the authenticated user has in ZITADEL based on the administrator roles the user has. (e.g: ORG_OWNER = org.read, org.write, ...)." }; } @@ -944,7 +944,7 @@ service AuthService { option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { tags: "User Memberships" - summary: "List My ZITADEL Manager Roles"; + summary: "List My ZITADEL Administrator Roles"; description: "Show all the management roles my user has in ZITADEL (ZITADEL Manager)." }; }